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In optical implementations of the phase-encoded BB84 protocol, the bit information is usually 
encoded in the phase of two consecutive photon pulses generated in a Mach-Zehnder interferometer. 
In the actual experimental realization, the loss in the arms of the Mach-Zehnder interferometer is 
not balanced, for example because only one arm contains a lossy phase modulator. Therefore, the 
amplitudes of the pulses is not balanced, and the structure of the signals and measurements no 
longer corresponds to the (balanced) ideal BB84 protocol. Hence, the BB84 security analysis no 
longer applies in this scenario. We provide a security proof of the unbalanced phase-encoded BB84. 
The resulting key rate turns out to be lower than the key rate of the ideal BB84 protocol. Therefore, 
in order to guarantee security, the loss due to the phase modulator cannot be ignored. 

PACS numbers: 03.67.Dd, 03.67.Hk, 42.50.Ex, 42.79.Sz 



Quantum key distribution (QKD) provides a way for 
two distant parties (Alice and Bob) to establish a shared 
secret key with absolute confidentiality. Many protocols 
1 have been suggested to achieve this goal, among which 
the BB84 protocol [2] is the most well-known example. In 
the BB84 protocol, Alice randomly chooses between two 
conjugate bases of a qubit Hilbert space, and encodes the 
bit value of the key elements in the basis states. She sends 
these states to Bob through a quantum channel, who 
measures them randomly in one of the conjugate bases. 
After having collected enough data, they perform error 
correction to eliminate the errors in their data, followed 
by privacy amplification to guarantee the security of the 
generated key from an eavesdropper (Eve). 

In optical implementations, the bit information is usu- 
ally encoded in a photonic degree of freedom, e.g., in the 
polarization of photons, or the phase of two consecutive 
photon pulses. In the phase-encoded protocol, the phase 
between two consecutive pulses prepared by Alice deter- 
mine the bit and the basis value of the sent signal. In 
the actual experimental realization of the phase-encoded 
BB84 protocol with Mach-Zehnder interferometers (see 
Fig. [T]), the phase modulator, which is in one arm of 
the interferometer, introduces loss. While this does not 
change the observed error rate in the data, it changes 
the signal states and the measurements of the protocol. 
Since this is now a different protocol, the security proofs 
tailored to the BB84 protocol no longer apply in this 
scenario. 

In this work, we provide a security proof of the phase- 
encoded BB84 where we take into account the loss in 
the phase modulator ( "unbalanced phase-encoded proto- 
col"). We use the security approach presented in Refs. 
[2l 0] to calculate the key rate. This security approach 
is valid when Eve is restricted to collective attacks, but 
in many situations, it also holds for the more general 
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coherent attacks. 

We provide a qubit-based security proof, that is later 
extend to optical modes. At the source side, we extend 
the validity of the qubit-based security proof to optical 
modes using the tagging approach introduced in Refs. [5, 
6 in the decoy framework [THSj. On the other hand, the 
squashing model in Refs. [TUHT2] justifies the assumption 
of a qubit-based security proof at the receiver's side. 



I. PROTOCOL SETUP AND PROOF 
TECHNIQUES 

A. Unbalanced phase-encoded protocol 

A scheme of the protocol setup is provided in Fig. [T] 
Alice sends photon pulses through a Mach-Zehnder in- 
terferometer with a long arm and a short arm, to create 
the signal states. In the long arm, Alice changes the rel- 
ative phase (p x of the two pulses with a phase modulator 
to imprint the basis and the bit information on the sig- 
nal. Alice chooses the phases <p x = |x for x € {0, 1, 2, 3} 
with equal probability for the 4 signal states. The phases 
(p x G {0,7r} and ip x £ {7r/2,37r/2} correspond to the 
bit values {0, 1} in the "even" and "odd" basis. Like- 
wise, the receiver (Bob) detects the signals by means of 
a Mach-Zehnder interferometer. Bob chooses the phase 
<Pb G {0,7r/2}, which determines the basis ("even" or 
"odd") of his measurement. Bob chooses each measure- 
ment setting with probability 1/2. 

The pulses arrive in Bob's detectors in three different 
time slots, either in the top output port (slots c\, c-i and 
c 3 in Fig. [T]) or in the bottom output port (slots d\, di 
and c?3 in Fig. [I]). Only the middle clicks (slots C2 and 
c^) are used for the key generation. The outside clicks 
(slots Ci, C3, d\ and d^) are pulses that did not interfere 
at Bob's second beam splitter. If the signal produces 
interference (e.g. the detectors click in the middle time 
slot), then Bob determines the bit value of the incoming 
signal based on his phase setting. 
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FIG. 1: Alice and Bob use a Mach-Zehnder interferometer to prepare and detect the signal pulses. Only the interfering pulses, 
which produce clicks in the time slots C2 and (fe (black-red and red-black overlapping pulses) are used for the key generation. 
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FIG. 2: A variation of the protocol with the pulses encoded 
in different polarization. Bob places a polarizing beam split- 
ter (PBS) at the entrance of his interferometer, and rotates 
the polarization in one arm of the interferometer, for exam- 
ple by using a half wave plate (HWP) to cause the desired 
interference. 



FIG. 3: a) Original picture of the unbalanced phase-encoded 
protocol with the loss in Bob's interferometer, b) Equivalent 
lossless interferometer picture with a loss 1 / (2£) in the chan- 
nel followed by lossless interferometer with an uneven beam 
splitter with transmissivity £. 



To obtain the data for the key generation, Alice and 
Bob apply a sifting step, in which they announce to each 
signal the basis ("even" or "odd") publicly and discard 
all data points where the basis did not match. 

The lossy phase modulator typically introduces a loss 
in one of the arms of the interferometer, producing pulses 
with different amplitudes. We model the lossy phase 
modulator by a perfect (lossless) phase modulator fol- 
lowed by a beamsplitter with transmissivity n < 1 that 
simulates the loss. 



B. PBS protocol 

As a slight variation of the protocol, consider Alice en- 
coding her outgoing pulses in different polarization, and 
Bob replacing his first beamsplitter by a polarizing beam- 
splitter (see Fig. [2]). This causes the two pulses to arrive 
simultaneously at Bob's second (interfering) beamsplit- 
ter. If he also rotates the polarization of the signal in 
one arm, all signals will interfere. We analyze the secu- 
rity proof of this protocol as well. Throughout the paper 
we will call this protocol the PBS protocol. 



C. Proof techniques 

Typically, we assume that the eavesdropper (Eve) in- 
tercepts the quantum channel between Alice and Bob 
with the goal to learn about the key. Eve can tamper 
with the signals at will, but her interaction will introduce 
some disturbance to the signals, which can be detected 
by Alice and Bob. 

It is generally difficult to provide a security proof for 
a scenario with a lossy measurement. Therefore, we con- 
struct a picture where a lossy beamsplitter with trans- 
missivity j| is placed into the quantum channel followed 
by a lossless interferometer with an uneven first beam- 
splitter with transmissivity 



This "lossless interferometer" picture is equivalent to the 
original picture with the lossy phase modulator in the 
long arm of the interferometer, as it yields the same mea- 
surement outcomes. The two pictures are shown in Fig. 
|3j However, in the lossless interferometer picture we can 
deal with the loss (that has now been outsourced to the 
channel) by giving Eve control over it and treat it like 
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FIG. 4: a) Hardware fix with the same amount of loss intro- 
duced in the short arm of the interferometer to compensate 
for the loss due to the phase modulator, b) Equivalent lossless 
interferometer picture. 



III. SINGLE PHOTON CONTRIBUTION 

In the following, we study the case where Alice sends a 
single photon and Bob obtains a single photon (qubit-to- 
qubit scenario). We analyze the signal structure and the 
measurements of the unbalanced phase-encoded protocol 
and the PBS protocol and provide a security proof (qubit 
security proof). Later, in section |Xj we embed the qubit 
security proof into the more realistic scenario with optical 
modes in infinite dimensional Hilbert spaces using decoy 
states [S] , tagging E] and squashing [TUHI2 • 



A. Alice's signal states 
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If a single photon is distributed over the two time 
modes (pulses) emerging from Alice, the resulting Hilbert 
space of the signal states (Hs) is a qubit space. We de- 
note the creation operators of the two time modes by 
dp and a\, and define the two canonical basis vectors 
|0) = ajlvac) and |1) = a{|vac) of Hs- After Alice im- 
printed her phase choice onto the pulses, the signal leav- 
ing her apparatus can be in either of the four possible 
states 



FIG. 5: Hardware fix with a biased beamsplitter in the 
interferometer to compensate for the loss due to the phase 
modulator, b) Equivalent lossless interferometer picture. 



regular channel loss in the security proof. 

In the case of the PBS protocol, we allot the control 
over the polarizing beam splitter and the lossy beamsplit- 
ter with transmissivity n in the long arm to Eve, leaving 
Bob with a lossless detector. 



II. HARDWARE FIX 

One simple way to recover the original BB84 scenario 
is by manually introducing a beamsplitter with the same 
transmissivity k in the shorter arm of the interferometers 
to compensate for the loss due to the phase modulator. 
Alternatively, one can replace the first beamsplitter in 
the interferometer by a biased beamsplitter with trans- 
missivity 1— £. A schematic of these alternatives is shown 
in Figs. [4] and [5) 

The BB84 signal states and measurements are recov- 
ered in the equivalent lossless interferometer pictures, 
which are shown in Figs. [4] and [5] for the two hardware 
fix possibilities. Under the assumption that the loss is at- 
tributed to Eve, the security proof reduces to the known 
BB84 security proof. 



I^) = ^|0) + v / l 3 e^/ 2 |l>. 
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for x £ {0,1,2,3}. The relationship between £ and k 
was already defined in Eq. (JlJ . In Fig. [6] we show a 
representation of the signal state on the Bloch sphere in 
comparison to the signal states of the BB84 protocol. 

Alice then sends the signal states with equal proba- 
bility through a quantum channel to Bob. This scheme 
is called prepare-and-measure scheme. Alternatively, the 
distribution of the signal states is captured in the source- 
replacement scheme: Alice constructs a (hypothetical) 
entangled state |$) G Has in her lab, and sends the sec- 
ond system (S) to Bob. By means of a positive operator 
valued measure (POVM) Alice performs a measurement 
on the system A, which effectively prepares the signal 
states on the system S for Bob. Furthermore, the re- 
duced density matrix pa — trs(|$)($|) is fixed in the 
source-replacement scheme. In our case, the entangled 
source state is |$)as = \/£|00) + y/l - £|11) with a re- 
duced density matrix 



^ = £|o)<o| + (i-0|i)<i|. 



(3) 



Alice's POVM elements on Ha are then essentially BB84 
measurements 
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for x G {0,1,2,3}. We denote by P[\a)] = \a){a\ a 
projector. 
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FIG. 6: Comparison of the qubit signal states on the Bloch 
sphere, a) The signal states of the BB84 protocol, b) the 
signal states of the protocol with a lossy phase modulator. 



C. Bob's detection in the PBS protocol 

In a similar manner, the modes in the output ports of 
Bob's interferometer in the PBS protocol are found to be 



„t - 



(e 



1 



ia\), 



-iVB„\ 



There are only two output modes, since there are no out- 
side clicks in this protocol. Bob's corresponding POVM 
on the input system has 4 elements for y £ {0, 1, 2, 3} 
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B. 



Bob's detection in the unbalanced 
phase-encoded protocol 



The modes aj and a[ arrive at Bob's detector after 
Eve interacted with the signals. The output of Bob's de- 
tectors carry 6 modes in total, 2 in each of the 3 time 
slots. We denote the modes of the top (bottom) detec- 
tor by cj (d\) for i = 1,2,3, respectively. For a fixed 
phase ifB € {0,7r/2}, the transformation of the a\ to 
the modes in the top and bottom detectors yield (up to 
global phases): 

4 = -J=(v^4 + e ^^a t 1 ), 



-,t 



d\ = 



-^(V^foJ-e^VCat), 



We choose to combine several outputs into one POVM el- 
ement of Bob's measurement (coarse-graining). In terms 
of the incoming modes |0) and |1), Bob's POVM elements 
are 



B v = -p[^~m + Vl^y' 2 \i))], 



£out = £|o)(o| + (i-oii)(i|, 



(5) 



where for y runs over {0, 1, 2, 3}. The 4 POVM elements 
By correspond to inside clicks (time slot 2) in the two 
bases, while B out denotes the POVM element of the out- 
side clicks (time slots 1 and 3). 



which is essentially a BB84 measurements. 

Indeed, in the PBS scenario, both Alice's and Bob's 
measurements are BB84 measurements. The difference 
between the PBS protocol and the BB84 protocol, how- 
ever, is found in the reduced density matrix pa, which 
contains the information about the modified signal struc- 
ture as shown in Fig. [6j 



IV. DESCRIPTION OF THE OPTIMAL 
ATTACK 

Eve's interaction with the signals typically introduces 
some disturbance to the source state |$). The actual 
state that Alice and Bob share after Eve's interaction is a 
general unknown (mixed) state pab ■ The only knowledge 
Alice and Bob hold about pab is concentrated in the 
probability distribution 



p(x, y) = tr{A x (g) By pab} 



(7) 



of their measurement outcomes with respect to the 
POVMs M A = {A x } and M B = {B y }. These proba- 
bilities are determined during the step of parameter es- 
timation. Additionally, they also know that Alice's re- 
duced density matrix pa = tiB(pAB) is fixed, because it 
never entered Eve's domain. Consequently, they hold a 
parametrization of the set of all possible density opera- 
tors pab that are compatible with p(x, y) and pa, which 
we define in the following by T: 

Definition 1 The set T contains all bipartite states pab 
that have a given reduced state pa and are compatible 
with the measurement outcomes p(x , y) . 

In the source-replacement scheme Eve's attack is de- 
scribe by the purification \^)abe of Pab- The purifica- 
tion lives on a dilated space Habe, where the dimension 
of the purifying system E is the same as the dimension 
of AB. Giving Eve full control over \^)abe, allows her 
to exploit everything allowed by quantum mechanics for 
her attack. 
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V. KEY RATE FORMALISM 

Along the lines of Ref. [T3], we derive the key rate 
that Alice and Bob can extract from a state \ty) using 
postselection, such as basis sifting. 

A. Key rate formula 

Given Alice, Bob and Eve share the state l^). Af- 
ter the measurement with respect to the POVMs M A — 
{A x } and Mb = {B y }, the three parties share a classical- 
classical-quantum (ccq) state [3] 

pxye= p( x >y)\ x 'y)( x >y\® p x e- ( 8 ) 

The probability p(x,y) was already defined in Eq. ([7]), 
whereas Eve's conditional states are given by p x E v = 
tr AB {A x ®B y ® l E \^)(^\}/p(x,y). According to Refs. 
H], the key rate that can be extracted from such a 
state is 

r(p XYE )=I(X :Y)- X (X :E), (9) 

where I(X : Y) = H(X) + H(Y) - H(X,Y) is the clas- 
sical mutual information between Alice and Bob's data 
p(x, y), and x(X : E) = H{X) + S(E) - S(X, E) is the 
Holevo quantity between Alice and Eve. H and S denote 
the Shannon entropy and the von Neumann entropy, re- 
spectively. If pab is known, the Holevo quantity can 
be expressed in terms of Eve's states p x E conditioned on 
Alice's value x and her reduced state p E = J2 x p( x )Pe 

X (X : E) = S{ PE ) -J2p(x)S( Pe ). (10) 

If Alice's POVM elements are rank-one projectors, an 
explicit reference in the Holevo quantity to the system 
E can be eliminated. It can be expressed in terms of 
quantities on the systems AB only: 

X (X:E)=S( Pab )-J2p( x Wb)- (11) 



B. Key rate formula with postselection 

First we introduce the same notation as in Ref. [T3] 
with emphasis on the dependence of the key rate on pab 
and the corresponding measurement, rather than the ex- 
plicit ccq state P xye- In the new notation we denote the 
Holevo quantity by 

X { P abMa) :=X{X:E). (12) 

In the classical description of the postselection, Alice 
and Bob make an announcement to each measurement 
outcome to filter out uncorrelated data. Alice announces 



the basis of her outcome ( "even" or "odd" ) , and Bob an- 
nounces the basis of his outcome ( "even" or "odd" ) if it 
was an inside click. If it was an outside click, he and an- 
nounces "out" . These announcements do not reveal the 
bit values. Based on the announcements, they keep the 
events where both announced "even" or both announced 
"odd", and discard the rest. We denote the events where 
they had the same announcement by u = "even" or u = 
"odd". The identification of the announcements effec- 
tively defines the subsets m c A vcn = {A .A 2 }, m° A dd = 
{A^As}, m c B vcn = {B ,B 2 } and m^ dd = {B 1} B 3 } of 
the POVMs M A and M B , which contain the POVM el- 
ements corresponding to the announcement u — "even" 
or«= "odd" . 

The quantum version of the postselection is described 
by a two-step process on pab'- first, a trace-preserving 
quantum map £ is applied to pab that takes care of the 
announcement and discarding. The Kraus operators of 
the map are given by F A (g> F B corresponding to the coin- 
ciding announcements u. The filters are explicitly given 

by FX = ^Jj2 ml A x and Fg = ^ m „ B y . 

This map creates an ensemble {J- u [pab], p{u)} of nor- 
malized states 

F u [ P ab] = Fl® F% PAB {Fl ® F^/p(u), (13) 
p(u)=ti{F2®F%p A B(F A l ®F^}, (14) 

each with probability p(u) — The probability that 

Pab is kept in this process is pkopt = J2 u p( u )- 

In the second step, the states J- u [pab] are measured 
with respect to new measurements M\®M B conditioned 
on u. The new POVMs and M B are found by renor- 
malizing the sets and m B by the pseudo-inverses of 
the filters defined on the non-zero subspace of F% (g> F B . 
This ensures that measuring T u \p AE \ with respect to 
M\ <g> yields the same outcomes as measuring pab 
with respect to ®M. B : 

= {{F^A^Ffy 1 : A x E m A }, 
M B = {(F^ByiF 1 *)- 1 : B v € m« }. (15) 

In [TS], the key rate after post-selection (f) extracted 
from each coinciding announcement u independently is 
given by 

f{£( PAB )) = lobs - x(£(pab)), (16) 

with the following definition of the overall Holevo quan- 
tity 

x(£(pab)) ■■= X>(«)X(.TW],M2). (17) 

u 

The overall mutual information I oas is the mutual infor- 
mation of Alice and Bob's data after postselection. It is 
fixed by the measurement outcomes p(x,y). 



G 



C. Description of Eve's optimal attack 

Typically, the state \^f) is not completely know to Al- 
ice and Bob. They might hold only partial information 
about [*&) via the characterization of the set T in the 
parameter estimation step. If this is the case, Alice and 
Bob must assume that Eve chose the most powerful at- 
tack (optimal attack) compatible with T, which is the 
attack that yields the lowest key rate 



r m in = min t{£{pab)) 

= Job 8 - max x(£(pab))- 



(18) 



While the first term (/ bs) is fixed by Alice and Bob's 
measurement outcomes p(x, y), the second term (x) is 
obtained through optimization over all possible attacks. 



VI. SYMMETRIES IN PROTOCOLS 

In this section we describe a scenario in which we can 
show that the optimal attack carries a certain symmetry 
without loss of generality. Under the assumption that 
Alice and Bob use a coarse-grained version of the exact 
probability distribution p(x, y) for the parameter estima- 
tion, and if the overall Holevo quantity \ satisfies certain 
symmetry properties, it can be shown that the optimal 
attack lies within a symmetric set. The symmetry prop- 
erty of the optimal attack is useful in the optimization of 
the key rate in Eq. (18). For a detailed analysis see Ref. 

M- 

First, let us define the symmetries of the POVMs 
and M^. Let G be a symmetry group with group ele- 
ments g and a unitary representation U g on the Hilbert 
space Hs- A set S containing operators on Hs is called 
G-invariant, if for all elements s x G S and all U g G G it 
holds that U g s x U g ~ :— s g ^ € S. 

Suppose our protocol is equipped with POVMs 
and Mb that exhibit the following G-invariance 



U*A X U£ =: A g(x) e M A , 
U a B y Ul =: B g(y) e M B . 



(19) 
(20) 



only averaged observations, like the average quantum bit 
error rate, are used for this task. The averaged observa- 
tions that we choose to use in our protocol are invariant 
under permutation of the p(x, y), in the sense that 



Q[{p(x,y)}}=Q[{p g (x,y)}]. 



(22) 



In this scenario, all states U g [pab] & re compatible with Q, 
whenever pab was compatible with Q. If Q is also linear 
in p(x, y), we can also include the convex combination 



PAB 
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E U 9\P- 



AB 



(23) 



gee 



to the set of compatible states. Here, |G| is the cardinal- 
ity of the group G. Consequently, we define the new set 
r avc , containing all density operators which are compati- 
ble with Q and pa- The new set r avo is a superset of the 
original set T. 

As shown in |13j , if the Holevo quantity is concave in 
Pab an d satisfies the equivalence property, x(£(pab)) = 
x(£ (U g [pAB]))i the quantity x(£(p~ab)) calculated from 
the symmetrized state pab always upper bounds the 
quantity x{£{pab)) calculated from pab € r ave . There- 
fore, without loss of generality, the optimal attack is 
found in a set f defined as follows: 

Definition 2 The set T contains all bipartite sym- 
metrized states pab that are compatible with Q and that 
have a given reduced state pa- 



We then obtain the key rate: 



max x(£(pab))- 



p AB er 



(24) 



VII. CONVEXITY AND EQUIVALENCE 
PROPERTY OF x IN THE EXAMPLE OF THE 
UNBALANCED PHASE-ENCODED PROTOCOL 



In this section we show the concavity and equiva- 
lence property of x m the case of the unbalanced phase- 
encoded protocol. We then compute the key rate in the 
scenario with the coarse-grained parameter estimation. 



Consider now a state 



U g \pAB\ = U* g ® UgPABUT ® Ul 



(21) 



which is unitarily equivalent under the symmetry group 
to pab ■ If we measure U g [pab] with respect to M^giM b , 
the resulting probability distribution, p g (x,y), of the 
measurement outcomes is, by virtue of the G-invariance, 
a permuted version of p(x,y). Furthermore, if pA — 
UgPAUg, the reduced density matrix of U 9 [pab] is un- 
changed. 

In the parameter estimation Alice and Bob are free to 
use a coarse-grained version Q[{p(x,y)}] of the detailed 
probability distribution p(x,y). In fact, in many cases, 



A. Postselection 

In the sifting process Alice and Bob postselect on 
events in the same basis ( "odd" or "even" ) in the middle 
time slot. We first calculate Alice's filters for this posts- 
election from the "odd" and "even" POVM elements in 
Eq. @: 



F A := Ff d = FI ven = 1 



(25) 



The new renormalized POMV measurements condi- 
tioned on u are related to the original POVM elements 
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in simply by a factor 2: 



C. Concavity and equivalence property of \ 



MT D = {"2A ,2A 2 }, 
M odd ^{2A 1 ,2A 3 }. 



(26) 



We also calculate Bob's niters from the "odd" and "even" 
POVM elements in Eq. §5^. There is a dependence on £ 
in Bob's filter, but again the filters are equal for "even" 
and "odd" bases 



. TT'Cvcn j^odd 



(27) 



Here the filters are presented in the basis {|0), |1)}. It is 
straightforward to find Bob's post-selected POVMs 



MT n = {2B' ,2B' 2 } : 
M° B dd = {2B[,2B' 3 }, 



(28) 



expressed in terms of the BB84-type measurements B' y 
in Eq. 



B. Symmetries 



The symmetry group G governing the POVMs A x and 
By is the cyclic group C4 with 4 elements. A reducible 
representation of C4 in the canonical basis of the signal 
states is given by 



U a 





e igir/2 



9 e {0,1,2,3}. 



(29) 



Alice and Bob's POVMs satisfy the symmetry relation 
U*A x Uj = A x+g and U g B y W g = B y+g where addition is 
taken modulo 4, while the outside element B out and the 
reduced density matrix p A in Eq. ([3]) remain invariant 
under the action of U g . Note that complex conjugation 
and Hermitian conjugation are equivalent operations for 
all unitaries U g , because they are simultaneously diago- 
nal. 

Not only are the POVMs and M B C 4 -invariant, 
but also the post-selected POVMs satisfy a certain sym- 
metry relation with respect to C4. Let us define the ac- 
tion of a unitary U on a POVM M = {K x } by 



UMU^ := {UK X U^} 



(30) 



The C 4 -invariance of the sets of POVMs and M U B is 
given by 



u;m- a uJ 



M 



U M u R Ul = M 



s(«) 

A ' 
9(w) 



For this particular example, g(u) — u © parity(g) with 
parity(p) <E {even, odd}. The addition is defined by the 
rules: even © even = odd © odd = even and odd © even = 
even © odd = odd. 



From the property that the filters are equal for "even" 
and "odd" announcements in Eqs. (25 27), we can derive 



the relationship between "even" and "odd" normaliza- 
tion p(odd) = p(even) =: ft and the postselected density 
matrices: 



T[ P ab] := J~ Bven [pAB] 



■podd 



[p 



AB 



(32) 



While ft(u) depends on the density matrix pab , the nor- 
malized probability distribution p(u) does not: p(odd) = 
p(even) = ^. Furthermore, the filters commute with all 
unitaries U g for Alice and Bob: 



[F K ,U g ] =0 \fg e G, K e {A, B}. 



(33) 



Consequently, T in Eq. ( 32 1 commutes with the symme- 
try group 



F[U g \p AB ]]=U g [r\p AB }]. 



(34) 



Moreover, T acts linearly on any convex combination 
of states of the form U g [pAB], for example on the sym- 
metrized state pab 



Hpab] = pr F[U g [pAB]} 



(35) 



We have now all ingredients to show the concavity and 
the equivalence property of x- Consider three density 
matrices pab, &ab and the convex combination pab — 
^Pab + (^ — ^)&ab with A e [0, 1]. In Ref. |l3j it is shown 
that the quantity x{pab, Ma) is concave with respect to 
Pab, namely: 

X (pab, M A ) > X X {pab,M a ) + (1 - X)x{ctab, M A ). 

(36) 



Using Eq. (35 1 and ( |36[ ), the concavity of \ follows: 

u 

^ \ E j^i E X (F[U g [pAB]lM A ) (37) 



= t^i^2x(£{u 9 [pab})- 

g 

For the equivalence property we resort to lemma 1 in 
[13] that describes the invariance property of the Holevo 
quantity under unitary transformation 

X (U g [pAB},M A ) = X {PAB,U^M A U* g ). (38) 

(31) 

This property also holds for the postselected states due to 



the commutation rule in Eq. (34) and the G- invariance 
of the M\ in Eq. p} 



X 



(F[U g [pAB]]M 9 A (U) 



= x(FIpab},M a ). 



(39) 



The equivalence transfers to \ by means of Eqs. ( 39 ) and 



m P AB)) = \y,x(f\pab]m u a) 

u 



(40) 



= ^Ex(^>AB]],MS)=jf(£^])). 

Having showed concavity and equivalence, we can as- 
sume without loss of generality that the optimal attack 
is chosen from the set T. The two main properties used 
to prove the equivalence and concavity were essentially 
Eqs. p5l[27| and ((33 1. 



VIII. KEY RATES IN THE QUBIT-TO-QUBIT 
SCENARIO 



B lo- 
re 
i— 

>* 

CD 




0.001 : 



0.02 0.04 0.06 0.08 0.1 0.12 0.14 0.16 0.18 

Error rate 

FIG. 7: Key rates per postselected signal in the middle time 
slot for unbalanced phase-encoded protocol in dependence on 
the error rate Q for different values of k in the phase modu- 
lator. 



We now calculate the key rate of the unbalanced phase- 
encoded protocol in the qubit-to-qubit scenario. We as- 
sume that Alice and Bob perform the parameter estima- 
tion based on the average error rate 



p(0,2)+p(2,0)+p(l,3)+p(3,l) 
2p 



(41) 



which is calculated from the detailed probability distri- 
bution p(x,y) and the normalization p in Eq. (14 1. The 
average error rate satisfies the property |22|), which fol- 



lows from the G-invariance of and in Eq.(31) 



The symmetric state pab with respect to the C4 sym- 
metry group is generally described by the density matrix 



PAB 



(a f* 

b 

c 

\f d 



(42) 



with open parameters a, b, c, d and / that satisfy 
the trace conditions tv pab = 1< The matrix repre- 
sentation of pab is with respect to the canonical basis 
{| 00), |01), 1 10), |11)}. The reduced density matrix 



tr B (pab) = 



(43) 



is fixed by pa (see Eq. Q), which leads to the additional 
constraint a + b = £ on the parameters. Furthermore, the 
error rate constraint 



Q = 



p 



2p 



(44) 



eliminates another parameter. The normalization p is 
given by p= \{{l-\){a + c)+£,{b + d)) and 5R[/] denotes 
the real part of /. 



We calculate the Holevo quantity \ an d use MATLAB 
calling the optimization function fmincon to perform a 
numerical optimization over the states Pab G T. To sim- 
ulate the classical data used for the calculation of the 
mutual information, we assume a typical scenario with 
symmetric observations. The mutual information is then 
a function of the average error rate J b s = 1 — h(Q), with 
h denoting the binary entropy. 

In FigjT] we show a plot of the key rates renormal- 
ized on matching bases and clicks in the middle time slot 
for different values of k in the case of a lossless chan- 
nel. In particular, observe that as k increases, the key 
rate increases as well. This behavior originates from the 
signal state structure: as the signals become more non- 
orthogonal with increasing re, the eavesdropper has more 
difficulty to distinguish them. This advantage disappears 
quickly, though, once loss is added to the channel. For 
a fair comparison of the protocol performances, however, 
we must analyze the protocols under a realistic channel 
model. 



IX. CONCAVITY AND EQUIVALENCE IN THE 
CASE OF THE PBS PROTOCOL 



The PBS protocol differs from the unbalanced phase- 
encoded protocol only in the measurements on Bob's side. 
Bob's filters for the PBS protocol, 



F B > ■= Fg, cn = F^ d = I 



(45) 



also satisfy the properties in Eqs. (25 27) and (33). As 



these were the two properties needed to show concavity 
and equivalence of x, we can again assume a symmetric 
optimal attack of the form ( 42 ) . 
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X. KEY RATES FOR REALISTIC DEVICES 



The security proof in section |VIII| is tailored to the 
situation where Alice and Bob use perfect qubits (e.g. 
single photons). The actual experimental implementa- 
tions, however, are performed with optical modes in an 
infinite dimensional Hilbert space. In particular, Alice's 
device can send vacuum and multi-photons into the chan- 
nel, and Bob's detector can receive vacuum and multi- 
photons from the channel. In order to achieve a complete 
security proof, we need to include the deviation from the 
ideal qubit-to-qubit scenario. 

Recently, several powerful tools [51 |H1 ITUHL?"] have 
been developed to bridge the gap between theory and 
experiment, with the aim to extend the validity of qubit- 
based security proofs to the more realistic scenario of 
optical modes. On Alice's side, the multi-photon com- 
ponents are taken care of by using decoy states [8] , sup- 
ported by tagging [5j [6] . This essentially permits to es- 
timate the fraction of the single photon contributions in 
the data. On the other hand, the multi-photons entering 
Bob's detector are taken care of by the squashing method 
in Refs. [TUIU2) . If a squashing map exists for a certain 
measurement setup, then the detection pattern resulting 
from an arbitrary input state into Bob's detector can be 
interpreted as if it were coming from a single photon or 
a vacuum input. 

Note that this approach gives a provable secure key 
rate, however, higher key rates may be achievable with a 
refined analysis. The starting point for the refined anal- 
ysis is the observation that a photon number splinting 
attack on multi-photon signals does not leak the signal 
content with certainty to Eve, even after the basis an- 
nouncement. However, such an analysis will be rather 
involved. It is expected that for strong asymmetries in 
the balancing the refined analysis would improve the re- 
sults significantly, as the scheme then takes a similar form 
as the strong reference pulse schemes analyzed in [bHll5| . 



A. Key rate for unbalanced phase-encoded 
protocol with realistic devices 

For the unbalanced phase-encoded detector setup, a 
valid squashing map has been proven to exist in Ref . |12j . 
A schematic of the squashing idea is shown in Fig. [8] In 
the proof it is assumed that Bob's detectors can resolve 
the three different time slots. Therefore, a general incom- 
ing optical mode can trigger any possible click pattern 
in the 6 detection slots. A POVM is associated to this 
measurement, called the basic POVM. Through classical 
post-processing, described in more detail below, several 
basic POVM elements are combined to form the effective 
(single-click) POVM elements. The effective POVM has 
5 elements {Bf , Bf , Bf , Bf , Bf t }, which reflect the 
single-click structure of the target qubit POVMs given in 
Eq. ([5]). The squashing map in Ref. then maps the 
effective POVM to the target POVM. 



Basic 
POVM 



Post- 
processing 



Effective POVM 



4$ 



Squashing 




FIG. 8: The basic POVM combined with classical post- 
processing forms the effective POVM, which is mapped to 
the target (qubit) POVM by the squashing map. 



TABLE I: Mapping of the basic POVM to the effective 
POVM via probabilistic classical post-processing. 



Basic 


Effective 


Probability 


POVM 


POVM 




Single-click 


Single-click 


1 


Double-click (middle) "even" 


Bf 
Bf 


0.5 
0.5 


Double-click (middle) "odd" 


Bf 
Bf 


0.5 
0.5 


Multi-click (outside only) 


RC ff 

"out 


1 




Bf 


0.125 




Bf 


0.125 


Cross-click 


Bf 


0.125 




Bf 


0.125 




RC ft 

"out 


0.5 



The post-processing in Ref. [T3] that maps the basic 
POVM to the effective POVM is shown in Table |H In 
order to maintain the statistics for an incoming single 
photon, any single-click basic POVM element is mapped 
to the corresponding effective POVM clement. Further- 
more, the basic multi-click POVM elements are processed 
as follows: double-click POVM elements in the "even" 
("odd") basis in the middle time slot are mapped with 
equal probability to Bf or Bf (Bf or Bf ); outside 
multi-click POVM elements are always mapped to the 
outside POVM element Bf t ; cross-click POVM elements 
(simultaneous middle and outside clicks) are probabilisti- 
cally mapped with probability 0.5 to i?out an d with prob- 
ability 0.125 to each of the four Bf, y € {0, 1, 2, 3}. This 
post-processing essentially maps double-clicks to errors in 
the data. 

Due to the existence of the squashing map, we can 
assume that all detection events on Bob's side are single- 
photon events, whereas Alice's source can either send a 
vacuum signal (it), a single-photon (s) or multi-photons 
(to). 

In the error correction step, Alice and Bob must correct 
all errors in their data. Therefore, the error correction 
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term, which is the mutual information, depends on the 
total observed error rate Qtot: lobs = 1 — h(Qtot)- Due to 
the decoy states and the tagging method, however, the 
privacy amplification term, which is the Holevo quan- 
tity, splits into the individual contributions from vacuum, 
single-photon or multi-photon signals (x v , Xs and Xm)- 
Let us define by p m id(a) the probability that the signal 
a G {v,s,m} sent by Alice produced a click in a middle 
time slot in Bob's detector, and the total probability of 
a middle click by p mid = J2ae{v,s,m} Pmid(a)- Then the 
total key rate is given by 



R — ^ I /'mi.! /.,!,„ 



^2 Pmid («) Xa 
a£{u,s,m} 



(46) 



A factor 1/2 was introduced for the sifting. 

Typically, we assume that Eve has full knowledge 
about the vacuum and the multi-photon signals (tag- 
ging), therefore Xv — Xm = 1- Only the term Xs enters 
the optimization. Due to the decoy and tagging meth- 
ods, Alice and Bob have an estimate of the error rate 
within the single photon events (q). The error rate q is 
the quantity appearing in the optimization and is gener- 
ally different from Qtot- 

When we are no longer dealing with the strict qubit- 
to-qubit scenario, we must make some modifications to 
the constraint on pa in order to adapt to the realistic sce- 
nario. We can no longer use the full information pa in 
Eq. (§ to constrain the reduced density matrix tr# {pab ) 
in Eq. ( [43] ). Recall that the fixed reduced density ma- 
trix pA describes the reduced density matrix of all single 
photons exiting the source. These photons are lost in the 
channel with probability pi os t, and arrive in Bob's detec- 
tor with probability 1— p\ os t- The reduced density matrix 
Pa of the total photons is conserved in this process 



p A = (1 - Plost)tT B (pAB) +PlostPA 



lost 



(47) 



where pj| st is an unknown density matrix corresponding 
to the lost photons. We use this weaker version to con- 
strain tr b(pab) in the optimization of the Holevo quan- 
tity Xs- 

We optimize the Holevo quantity Xs over the set of 
symmetric states pab (Eq. (42)) with the error rate con- 
strain q and the relaxed constraint in Eq. ( 47 ) on the re- 



duced density matrix. The dependence of the optimized 
Holevo quantity on q, p\ os t and k is denoted in square 
brackets X™ ax [i?,.Piost, k]. The total optimized key rate 
for the unbalanced phase-encoded protocol is then given 
by 



R 



+ Pmid(s)(l-Xr X [9,Plost,K]) 



(48) 



In Figs. [9] and [To] we plot the key rates of the unbal- 
anced phase-encoded protocol and the hardware fixes for 
different values of k. We simulate a channel using the 




20 40 60 80 100 120 140 

distance [km] 

FIG. 9: (color online) Plot of the key rates in the realis- 
tic scenario, a) Key rate of the PBS protocol with no loss 
(dashed blue line), b) Key rate of the PBS protocol with 
ft = 0.5 (dashed red line), c) Key rate of the unbalanced 
phase-encoded protocol with no loss (« = 1) (solid blue line), 
d) Key rate of the unbalanced phase-encoded protocol with 
ft = 0.5 (solid red line) coinciding with the key rate of the 
hardware fix with an uneven beamsplitter (black circles), e) 
Key rate of the hardware fix with additional loss in the short 
arm (black line). 




20 40 60 80 100 120 140 



distance [km] 

FIG. 10: (color online) Plot of the key rates of the unbal- 
anced phase-encoded protocol for different values of ft. 



experimental values in Ref. [IB] for channel loss, dark 
counts, detector efficiency and error correction efficiency, 
and assume that no double clicks were observed. We 
also optimize over the mean photon number of the signal 
pulses leaving Alice. 

Generally, the loss in the phase modulator decreases 
the key rate of the protocols. The performance of the un- 
balanced phase-encoded protocol coincides exactly with 
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the performance of the hardware fix with an uneven 
beamsplitter, providing a choice between the hardware 
fix (requiring a special unsymmetrical beam splitter) , and 
the improved theory solution presented here. Both of 
these scenarios, however, outperform the second hard- 
ware fix with an additional loss in the short arm. 



B. Key rate for PBS protocol with realistic devices 

For the PBS protocol detector setup the squashing map 
is shown to exist in Refs. [TU1 E] ■ Since all pulses inter- 
fere, we can drop the specification on middle clicks in the 
key rate. We call the probability that Alice sent a sin- 
gle photon and Bob detected it by Pdet(s) and the total 
detection probability p dc t = J2 a e{v,s,m} Pdet(o)- The key 
rate in the PBS scenario is then 

R = 2 ( -PdotMQtot) +Pdet(*)(l - *?"*[?, JW, «]))• 

(49) 

We plot the key rates of the PBS protocol in Fig. [9] 
for different values of k. The key rates of the PBS pro- 
tocol are higher than the key rates of the unbalanced 
phase-encoded key for equal loss in the phase modulator, 
because no signal is lost due to outside clicks. Neverthe- 
less, the loss in the phase modulator decreases the key 
rates of the PBS protocol. 

XI. CONCLUSION 

We analyze the security of the phase-encoded BB84 
protocol with a lossy phase modulator in one arm of the 



Mach-Zehnder interferometer. We consider two proto- 
cols, the unbalanced phase-encoded and the PBS proto- 
col. We provide a qubit-based security proof, which we 
embed in the more general framework of optical modes 
using the decoy states method, tagging and squashing. 

In general, it turns out that the proven secure key rates 
are lowered by the unbalanced loss in the Mach-Zehnder 
interferometer, so that a performance evaluation based 
on the security analysis of the standard BB84 proto- 
col with laser pulses should not be used. The imple- 
mentation with additional polarization encoding of the 
pulses (PBS protocol) performs better than the one with 
no additional polarization encoding (unbalanced phase- 
encoded protocol), because all signals forcedly interfere 
in Bob's interferometer. A comparison of the key rates of 
the unbalanced phase-encoded protocol to the key rates 
of the two suggested hardware fixes shows that an exper- 
imental remedy is not necessary and does not contribute 
to an improvement of the key rate. 
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